For an r2 assessment, to obtain a Validated Report with Certification, each domain must score...

HITRUST requires that each of the19 domainsachieve a minimum score of71for an organization to qualify for r2 certification. This threshold ensures that entities maintain a consistent level of maturity across all control areas, rather than excelling in some while neglecting others. The 71 threshold is calculated from the weighted average of requirement statements within a domain, factoring in Policy, Procedure, and Implementation maturity scores (with Measured and Managed as applicable). If any domain falls below 71, the assessment may still produce a validated report, but it will not result in certification. This strict requirement highlights HITRUST’s emphasis onbalanced coverageacross all areas of security and privacy.